Privacy

Last updated: October 23, 2026

This statement is written in Norwegian. The English version below is a translation; where the two differ, the Norwegian text prevails.

This statement explains how Bahar Invest AS (“we,” or “us”) handles personal information when you use the Arq OS mobile app, an Arq OS service that we host, or norarq.com.

The data controller

Bahar Invest AS is the data controller for the Arq OS services we host and for norarq.com. Our contact details are at the bottom of this statement. If you discover a vulnerability or a security incident, reach us at security@norarq.com.

In short

Account information, content, files and backups are stored in Norway, at a European cloud provider.
All AI processing in the hosted service happens in the EU/EEA, at one European AI provider.
The AI provider does not use your data to train models. It logs only operational data, not the content of requests and answers.
Login tokens and keys for connected apps, secrets used by the agents, and personal information in the customer register are encrypted with AES-256-GCM.
We do not sell personal information.

Information we collect

Depending on how you use Arq OS, we collect:

Contact and account information, such as your name, email address, and authentication records.
Content you provide to the service, including agent instructions, messages, tasks, memories, files, routines, and support communications.
Connection information you choose to provide, such as encrypted credentials or tokens for connected applications and browser sessions, and secrets the agents use.
Technical information needed to operate and secure the service, such as IP address, user agent, session records, device push token, timestamps, and diagnostic information.

Purposes and legal bases

We process this information for the following purposes, on the legal bases in Article 6 of the General Data Protection Regulation (GDPR):

Providing, maintaining, and troubleshooting Arq OS, authenticating you, synchronizing your account across supported clients, and running the agents, routines, connections, and notifications you request: necessary to perform our agreement with you (Art. 6.1.b).
Securing the service against misuse and troubleshooting operational problems, using technical information such as IP address, session records, and diagnostics: our legitimate interest (Art. 6.1.f), weighed against your privacy.
Processing payments: necessary to perform our agreement (Art. 6.1.b). Accounting records are kept as required by law (Art. 6.1.c).
Sharing content with AI services from the mobile app: your consent (Art. 6.1.a). You can withdraw it at any time under Account → AI data sharing; the details are below.
Responding to support requests and following up on replies you report: necessary to perform our agreement (Art. 6.1.b) or our legitimate interest (Art. 6.1.f).
Complying with legal obligations (Art. 6.1.c).

Where your data is stored and processed

For the service we host:

Storage: servers, the database, uploaded and generated files, memories, and backups are at a European cloud provider, in a data centre in Norway. The agents’ computers run on servers we operate. Norway is in the EEA, not the EU.
AI processing: all AI processing in the hosted service goes through one European AI provider, a company established in the EU. Customers of the hosted service cannot connect other AI providers. The provider processes data only in the EU/EEA, and only to deliver the service. A transfer outside the EU/EEA requires our prior written consent.
Logging and training: the provider logs only operational metadata, such as time, model, token count, and error codes, not the content of requests and answers. The provider does not use the data to train models.
Subprocessors: the provider’s own subprocessors are in the EU/EEA, and it must announce new ones in advance.
Agreement: the provider processes data under a data processing agreement under GDPR Article 28, which Bahar Invest AS has accepted.

We provide the names of the hosting and AI providers on request at hello@norarq.com. Business customers receive them in the data processing agreement.

Service providers and AI processing

Before submitting content or starting AI work, the Arq OS mobile app shows what is shared, with whom and why, and asks you to allow sharing. Choosing Not now prevents the mobile action. Permission applies to the selected Space and recipient. Account → AI data sharing lets you withdraw permission for new mobile actions. Stop existing runs and disable routines separately; withdrawal cannot recall data already sent. Web and desktop workflows use the AI provider in the hosted service, without this mobile permission flow.

Arq: Arq is the AI in Arq OS. Messages, relevant conversation history, agent instructions, memories, attachments and file content, screenshots, and content retrieved from connected apps are sent to our European AI provider in the EU/EEA to generate responses and perform your tasks, including scheduled tasks.
Voice: when voice is on, recorded audio is sent to the AI provider for transcription, and text you choose to play, including agent responses, is sent for speech generation. Otherwise the agent uses the voice and speech recognition already on the device or in the browser. The maker of the device or browser governs those. If you turn on “Only answer my voice”, the voiceprint is kept on your device only, and deleted when you turn the setting off or sign out; in the mobile app our server makes it from the recording sent for transcription and does not keep it. Microphone access and permission to share with an AI service are separate choices.
Memory: memories are stored in our database in Norway. When semantic memory search is on, text chunks are sent to the AI provider to create search vectors (embeddings).
Notifications: when you allow notifications, we store your device’s push token and send notifications through Expo’s push service, which delivers them through Apple or Google. A notification can include an agent’s name and a short summary of its work.
Document scanning: on Android, scanning a document uses Google’s document scanner in Google Play services. The scan stays on your phone until you send it, and Google receives diagnostic data about the scanner, such as the device model and how it performed.
Reports: when you report an agent reply, we record the report and send the reply to the people who operate the service for review.

We collect this content from what you enter, upload, record, or authorize your agents to access. We store the recipient, Space, disclosure version, and time of your permission for the mobile app to remember your choices. We do not sell personal information or use Arq OS content for third-party advertising.

Services we select to process personal information must provide protection equal to or greater than the safeguards described in this policy, including limited processing purposes, appropriate security, and retention and deletion protections. Before enabling a provider, we review its terms and safeguards against these requirements.

The AI provider’s processing after receipt is governed by the data processing agreement with us, described above. Connected apps receive the content required for the actions you authorize. Their processing is governed by their applicable terms and privacy policies.

Processors and other recipients

In the hosted service we use these processors and other recipients:

Storage and hosting: a European cloud provider, in a data centre in Norway.
AI processing: one European AI provider, established in the EU, processing in the EU/EEA.
Email: Resend sends email to your account, such as verification, password reset, and notifications. The data is your email address, the subject, and the content of the email.
Payments: Stripe, through Checkout and the customer portal. Card details go directly to Stripe and are never stored by us. Stripe is an independent controller for some purposes, such as fraud prevention and legal obligations.
Traffic, TLS, and attack protection: Cloudflare. All traffic to norarq.com and app.norarq.com passes through Cloudflare’s network. Cloudflare terminates TLS, filters attacks, and provides the visitor’s country for site statistics.
Push notifications: Expo, which delivers them through Apple or Google. The data is your device’s push token and the notification content, such as an agent’s name and a short summary.

Resend, Stripe, Cloudflare, and Expo may process limited data outside the EEA. The transfer basis is described under Security and international transfers.

We use these providers as processors under data processing agreements under GDPR Article 28. Where Stripe processes information for its own purposes, Stripe is an independent controller for that processing.

Interest form and visitor statistics on norarq.com

Before the launch you can register interest on norarq.com. We store your email address, and your name and company if you give them, together with the page language, the page and campaign link (utm) you came from, and when you gave consent and to which version of this statement. We use these details only to tell you about the launch and follow up your interest, and we receive an email notice (through Resend) when someone registers. The legal basis is your consent (Art. 6.1.a). Withdraw it by emailing hello@norarq.com and we delete the entry. Otherwise we delete it no later than one year after your last submission.

We count visits to norarq.com with our own tool, without cookies and without third-party analytics. Your browser sends the page you view, its language, the site you came from and any campaign parameters (utm). The server also records the country (from Cloudflare), device type, browser and operating system. Your IP address and full user agent are not stored: they are only used to derive a pseudonymous counter ID with a random key that changes every day and is deleted during cleanup after the day ends. We use this daily ID to count unique visitors within that day. The counting stores nothing on your device. The legal basis is our legitimate interest in understanding how the site is used (Art. 6.1.f). The statistics are deleted after 13 months.

Chat on norarq.com

The chat on norarq.com is answered by an AI assistant. We store your messages, the page and language you wrote from, and contact details if you give them. We use them to answer questions about Arq OS, arrange a meeting you ask for, and follow up your interest. When you book a meeting, your name and email go into a calendar invitation sent from our calendar service. We receive a notice by email or as a push notification with a short summary, and can reply to you in the same chat. The legal basis is our legitimate interest in answering people who contact us (Art. 6.1.f), and steps you ask for before an agreement, such as a meeting (Art. 6.1.b). AI processing follows Where your data is stored and processed.

Automatic deletion of anonymous chats is not currently enabled. Conversations with contact details, a linked request or a calendar entry follow the customer register rules. If you create an account from the chat link, we record that source on your account to count registrations. The chat uses no cookies. After your first message, your browser keeps a key to the conversation in local storage, so the chat follows you between pages. The key expires after 30 days and is removed the next time the chat reads it. If you close a suggestion from the chat, your browser remembers that until you close the tab. You remove the key by clearing site data for norarq.com. To have us delete the conversation, email hello@norarq.com.

Retention and deletion

We keep hosted account information and content while your account is active and as reasonably needed to provide the service. You can permanently delete your hosted account in the Arq OS app or on the web; Support explains how and what deletion removes. Copies can remain in backups until those backups are deleted. Backups are encrypted before they leave the server and are stored in Norway. We may retain limited information when required by law, to resolve disputes, or to enforce agreements. Information already sent to a third-party provider is subject to that provider’s retention practices.

Security and international transfers

We use reasonable technical and organizational safeguards designed to protect personal information. No system is completely secure. In the hosted service:

All traffic is encrypted in transit with HTTPS/TLS.
Login tokens and keys for connected apps, and the secrets the agents use, such as passwords and API keys, are encrypted with AES-256-GCM before they are stored.
Personal information in the customer register (name, email address, phone number, notes, and organization number) is encrypted per Space with its own keys (AES-256-GCM). When you delete your account, the keys for Spaces where you were the only member are deleted, so that data can no longer be read.
Run journals are encrypted with AES-256-GCM.
Passwords are stored only as a one-way hash (scrypt).
Each thread’s history is hash-chained, so changes can be detected.
Backups are encrypted before they leave the server.

Account information, content, files, and backups stay in Norway. AI processing stays in the EU/EEA. Norway is in the EEA, not the EU.

For the four services under Processors and other recipients that may process limited data outside the EEA, we use a valid transfer basis: an adequacy decision, for example the EU–US Data Privacy Framework for certified companies, or the EU standard contractual clauses. Where needed, we assess additional safeguards.

Children

You must be at least 18 to use Arq OS. The service is not directed to children, and we do not knowingly collect personal information from children.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability (a machine-readable copy of your information), and to object to processing. You can withdraw a consent at any time. You can download your data and delete your account under Account → Privacy and security, or contact us. We normally respond within one month.

You can complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe our processing of personal information violates data protection law.

Changes to this statement

We may update this statement as the service or the law changes. We will announce material changes in the service or on norarq.com.

Contact us

Bahar Invest AS
Reg. no. 922 949 514
Silurveien 2, 0380 Oslo
hello@norarq.com
Security: security@norarq.com